Home › Cybersecurity wiki › What are synthetic accounts?

Wiki

What are synthetic accounts?

Synthetic accounts are fictitious customers assembled from mixed real and invented data so they look plausible to onboarding checks.

The profile does not belong to one real person, even when some fields were copied from genuine records.

How it works

Pieces may come from stolen files, public sources, and invented employment or contact history.
Automated checks see a complete looking form and may approve credit, a bonus, or a marketplace identity.

Manual review and consistency over time catch profiles that never belonged to a single life.
A cost on each signup also makes scripted creation of many fictitious customers less attractive.

Concrete examples

  • A credit application pairs a real street address with an invented job history.
  • A bonus program sees dozens of profiles that share fragments but no genuine customer.
  • A seller identity passes a format check and fails a later review of inconsistent facts.

Protective measures

  • Compare identity elements for consistency instead of accepting a complete form at face value.
  • Limit instant credit and bonuses on profiles with no prior history.
  • Investigate clusters of applications that reuse the same fragments.
  • Add cost to automated signup so fictitious customers are harder to mass produce.

How CDPCaptcha helps

Proof of work raises the cost of scripted signup for fictitious customers because each attempt must spend computing time before an account is created.

CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.